CVE-2025-3838

Improper Authorization in the installer for the EOL OVA based connect component

State: Published
Severity: 6.1 Medium
Published: Apr 21, 2025
Updated: Apr 21, 2025
Reserved: Apr 21, 2025

Description

An Improper Authorization vulnerability was identified in the EOL OVA based connect component which is deployed for installation purposes in the customer internal network. Under certain conditions, this could allow a bad actor to gain unauthorized access to the local db containing weakly hashed credentials of the installer. This EOL component was deprecated in September 2023 with end of support extended till January 2024.

Scores

CVSS	Score	Vector	Source
4.0	6.1 Medium	CVSS:4.0/AV:A/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N	Saviynt

Weaknesses

CWE-863 Incorrect Authorization
CWE-327 Use of a Broken or Risky Cryptographic Algorithm

Affected Products

Product	Versions
OVA based ConnectSaviynt	AlmaLinux-8.x_SC2.0-Client-2.0Affected AlmaLinux-8.x_SC2.0-Client-3.0Affected CentOS-7.x_SC2.0-Client-2.0Affected CentOS-7.x_SC2.0-Client-3.0Affected RHEL-8.x_SC2.0-Client-2.0Affected RHEL-8.x_SC2.0-Client-3.0Affected

References

https://saviynt.com/trust-compliance-security

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.